CVE-2025-0242: 
NixOS vulnerability analysis and mitigation

Memory safety vulnerability CVE-2025-0242 was discovered in Mozilla products, affecting Firefox 133, Thunderbird 133, Firefox ESR 115.18, Firefox ESR 128.5, Thunderbird 115.18, and Thunderbird 128.5. The vulnerability was disclosed on January 7, 2025, and was reported by Andrew McCreight, Tooru Fujisawa, and the Mozilla Fuzzing Team (Mozilla Advisory).

The vulnerability is classified as a memory safety bug that shows evidence of memory corruption. It has been assigned a CVSS v3.1 base score of 6.5 (MEDIUM) by CISA-ADP with the vector string CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N. The vulnerability is categorized as CWE-787 (Out-of-bounds Write) (NVD).

The vulnerability could potentially allow attackers to execute arbitrary code on affected systems. The memory corruption issues present in the affected versions could be exploited with sufficient effort to compromise system security (Red Hat, Mozilla Advisory).

The vulnerability has been fixed in Firefox 134, Firefox ESR 128.6, Firefox ESR 115.19, Thunderbird 134, and Thunderbird 128.6. Users are advised to upgrade to these versions to mitigate the risk (NVD, Mozilla Advisory).